Staging
v0.5.1
v0.5.1
https://github.com/python/cpython
Revision 30e769382dfb67a68fe8e6bfe8509addb4aa9514 authored by Miss Islington (bot) on 04 February 2020, 21:41:55 UTC, committed by GitHub on 04 February 2020, 21:41:55 UTC
When called on a closed object, readinto() segfaults on account of a write to a freed buffer: ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==220553== Access not within mapped region at address 0x2A ==220553== at 0x48408A0: memmove (vg_replace_strmem.c:1272) ==220553== by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972) ==220553== by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053) ==220553== by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253) Reproducer: reader = open ("/dev/zero", "rb") _void = reader.read (42) reader.close () reader.readinto (bytearray (42)) GH-GH-GH- BANG! The problem exists since 2012 when commit dc469454ec added code to free the read buffer on close(). Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com> (cherry picked from commit cb1c0746f277052e45a60d6c436a765e34722821) Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
1 parent 9a740b6
Tip revision: 30e769382dfb67a68fe8e6bfe8509addb4aa9514 authored by Miss Islington (bot) on 04 February 2020, 21:41:55 UTC
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
Tip revision: 30e7693
makeopcodetargets.py
#! /usr/bin/env python
"""Generate C code for the jump table of the threaded code interpreter
(for compilers supporting computed gotos or "labels-as-values", such as gcc).
"""
import os
import sys
try:
from importlib.machinery import SourceFileLoader
except ImportError:
import imp
def find_module(modname):
"""Finds and returns a module in the local dist/checkout.
"""
modpath = os.path.join(
os.path.dirname(os.path.dirname(__file__)), "Lib")
return imp.load_module(modname, *imp.find_module(modname, [modpath]))
else:
def find_module(modname):
"""Finds and returns a module in the local dist/checkout.
"""
modpath = os.path.join(
os.path.dirname(os.path.dirname(__file__)), "Lib", modname + ".py")
return SourceFileLoader(modname, modpath).load_module()
def write_contents(f):
"""Write C code contents to the target file object.
"""
opcode = find_module('opcode')
targets = ['_unknown_opcode'] * 256
for opname, op in opcode.opmap.items():
targets[op] = "TARGET_%s" % opname
f.write("static void *opcode_targets[256] = {\n")
f.write(",\n".join([" &&%s" % s for s in targets]))
f.write("\n};\n")
def main():
if len(sys.argv) >= 3:
sys.exit("Too many arguments")
if len(sys.argv) == 2:
target = sys.argv[1]
else:
target = "Python/opcode_targets.h"
with open(target, "w") as f:
write_contents(f)
print("Jump table written into %s" % target)
if __name__ == "__main__":
main()
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...